Time and event based message transmission

ABSTRACT

A system, apparatus and method for efficient utilization of available band-width on the system&#39;s bus connection. The system includes a scheduler configured to receive a virtual schedule that provides at least one slot for sending a message over the communication bus and to confirm a trigger condition. A module is configured to send a message over the communication bus when the trigger condition is confirmed.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. application Ser. No.12/717,822, which is a Continuation of U.S. application Ser. No.10/539,005, now U.S. Pat. No. 7,711,880, filed Mar. 3, 2006, which is aU.S. national phase application filed under 35 U.S.C. 371 ofInternational Application PCT/SE03/01736 filed Nov. 11, 2003,designating the United States, which claims priority from SwedenApplication 0203756, filed on Dec. 17, 2002.

FIELD

The present invention relates to a distributed control or monitoringsystem with an arrangement in a control, monitoring and/or vehiclesystem that comprises locally distributed module units (nodes) carryingout one or more functions and links connecting one or more units, withthe respective module unit being connected to the relevant link via aconnection arrangement or a connection point and requisite communicationdevice, preferably for the protocol CAN.

BACKGROUND

The CAN-system (Control Area Network) is currently well-known in variousconnections for controlling, processes, monitoring, etc. Among otherthings, it is used in various vehicle applications in order to controlvarious processes in the vehicle. In addition, it is used for functioncontrol in machinery, for example within the construction industry, inweaving sheds, etc. In connection with this, reference can be made tothe patent literature and the patent applications and patents that havebeen submitted and obtained by the Applicant of the present patentapplication.

In connection with control and monitoring systems of this type, there isan ongoing need to make the system as such more efficient, to improve itand to make it cheaper. A bottleneck for system performance is thebandwidth of the bus. To date, most systems based on CAN have beenconstructed on the basis that messages are sent event-driven. This meansthat the bus is poorly utilized and that the time for message transfervaries greatly. This fact has resulted in CAN generally being consideredto be unsuitable for safety-critical systems. Such systems should bebased on time-controlled scheduling of message transfers between thenodes in the system. Special protocols for this have been developed, forexample TTP and Flexray. A new standard for CAN with support for timescheduling is in preparation by ISO (“Controller area network (CAN) BPart 4: Time-triggered communication” ISO/CD 11898-4) which proposes howCAN messages can be time scheduled and how clocks for this can bearranged. An overview and discussion of the subject is published in thepublication IEEE Micro July-August 2002. TTP can be considered best tocorrespond to the current technology concerning distributed systems withhigh real-time and security requirements. This is a modern, advanced andwell-documented protocol for time-controlled systems that are used invessels. For detailed information, refer for example to H. Kopetz,“TTP/C Protocol”, TTTech 1999. A study of TTP/C shows that it makes highdemands to the effect that the clocks in the respective modules mustoperate within a high given tolerance and that special circuits must beused, so-called Bus Guardians, in order to ensure that no moduletransmits messages that collide with other messages on the bus. Ingeneral, serial protocols are divided into three classifications:Collision Avoidance (CA), Collision Detection (CD) and CollisionResolution (CR). Definitions of the classifications and the boundariesbetween them can vary. TTP is a typical CA protocol, that is allmeasures and steps are taken in order to avoid collisions. This is agenerally accepted starting point for traditional time-controlledsystems. The Ethernet is a good example of a CD protocol. Collisionsnormally arise on the bus and are detected. Colliding messages arediscarded and the transmitters send the messages again after a delay.The protocol has rules concerning this delay so that at least themodules that collided do not immediately collide again. The collisionsthus give rise to reduced bandwidth and mean that the maximum delay fora given message can not be calculated and guaranteed. CAN is an exampleof a CR protocol. Collisions are resolved in a predictable way. Theprice of this characteristic is a low maximum bandwidth and this is oneof the reasons that CAN has been considered not to be a suitableprotocol for time-controlled systems. In addition, thecollision-resolving characteristic has been considered by most expertsnot to be of value for time-controlled systems, as collisions are notsupposed to occur.

Traditionally, time-scheduled transmission of messages is considered tobe more efficient than event-driven transmission. However, the time slotthat is allocated to a message must be longer than the message in orderto take account of the difference between the modules' clocks. FIG. 1shows schematically a traditional schedule with time slots in which themodules A and B place their messages. As their clocks are not preciselysynchronized with the system clock, the messages are placed in practiceslightly earlier or later in the allocated time slot than what isspecified by the scheduling. This means that in traditionaltime-controlled systems the allocated time slot must be large in orderfor inaccurate clocks to be able to be used in the modules, whichresults in loss of bandwidth, or means alternatively that very accurateclocks must be used, which results in high costs. The present inventionaims to solve this problem, among others. In addition, immediateretransmission of discarded messages is not permitted in traditionaltime-scheduled systems as this would require longer time slots. Extractfrom ISO 11898-4: “Arbitrating time window conflicts are resolved by theidentifier arbitration of CAN and a CAN node may not start transmissionif the bus is not idle. Several CAN nodes in the network may start atransmission within the Tx_Enable window of an arbitrating time window.The immediate automatic retransmission is disabled”. The quotation showsthat it is a widespread belief that automatic retransmission should notoccur at all in CAN-based time-controlled systems and that a node is notto request start of message transmission of the bus if the bus is notexpected to be free. The present invention aims, among other things, toallow immediate retransmission of discarded messages. A characteristicof the invention is that a CAN node starts transmission when the bus isengaged (not idle).

Time-scheduled communication requires each node to keep time within agiven accuracy in relation to the system clock and requires each messageto be transmitted/received in a given time slot for the respectivemessage. This leads to the communication being sensitive to interferenceand to additional bandwidth having to be kept in reserve in order thatimportant messages will be certain to get through in time. A furtherdevelopment of the basic idea of the invention avoids this need andmakes possible the construction of a very robust communication systemwith predictable characteristics. A communication system can beconstructed by means of the invention, that has the respectiveadvantages of event-driven and time-controlled communication while atthe same time eliminating their respective disadvantages. A robustcommunication system with great adaptability to the requirements of thetotal system and with “graceful degradation” characteristics can beconstructed by means of the invention.

In accordance with the concept of the invention, the problems describedabove are solved by utilizing the known characteristics of a CAN messageand by the introduction of new concepts such as virtual and actualschedules and virtual system clock. The invention is applicable to otherprotocols than CAN that have the utilized CAN characteristics.

SUMMARY

The principal characteristics of an arrangement according to theinvention are apparent from the characterizing part of the followingclaim 1.

In the simplest form of the invention, the protocol utilizes CAN'scharacteristic that, in the event of a collision, the message that hascommenced transmission is not terminated, but the colliding messagewaits until the bus is again free and then immediately commences thetransmission. A practically 100% utilization of the bus bandwidth isobtained with the following method:

1. A virtual time schedule is set up where each message, at least thosethat are to be found under normal operating conditions, is allocated atime in accordance with a virtual clock at which the transmission of themessage is to commence in ideal conditions. The time slot for the startof transmission for the next message can be set to a value that must belarger than the average length of the message, measured in time.

2. Each module is allocated an actual schedule, related to an actualclock in the module, for the transmission of messages. The time fortransmission is set earlier than the time allocated in the virtualschedule.

3. The actual clocks in the modules are set in relation to the virtualclock.

4. The transmissions commence.

The method above shows a basic idea of the invention. First, there is ascheduling in relation to an ideal, virtual clock, where each message isgiven a time slot in which it can be transmitted without colliding withanother message. By this means, it is ensured that the bandwidth issufficient for transmitting the required information. The next problemis to make this scheduling work in practice. There are many ways to setup a global time in a system. In traditional time-synchronized systems,it is necessary that all modules in the system have a common time baserelated to a common clock, at least at each given moment in time. Anunorthodox solution is described in Chapter 6.2 in CanKingdom version3.01, where a message triggers transmission of another message and it isthereby possible to achieve a form of time-scheduled transmissionwithout a common time base. Variants of these methods are discussed inthe article “CAN for Critical Embedded Automotive Networks” in IEEEMicro July-August 2002 on page 33 under Time schedules. In a systemconstructed according to the invention, the different nodes can basetheir time on different references and can be synchronized in variousways. The only thing that a system designer must ensure is that in oneway or another each node is set in relation to the time of transmissionand reception of messages within a given tolerance in relation to thevirtual clock and that part of the virtual schedule that relates to therespective node. A common factor relating to solutions in accordancewith traditional time-scheduled communication is that transmissionattempts are commenced when the bus is free. This means that there aregaps in the communication. By means of instead deliberately starting thetransmission in the previous time slot, the collision-detectingmechanism will ensure that the message is sent as soon as this ispossible, and in this way the highest possible bandwidth utilization isobtained. This idea deviates radically from current thinking, andrequires clarification. In current thinking, it is taken as fundamentalthat absolute time constitutes the basis for the length and position ofthe time slots, not the time a message takes up on the bus. The scheduleis based on the common, ideal system time and all practical deviationsfrom this must be taken into account in the schedule by means of themessages being allocated larger time slots than the time they take upfor transmission. Drifting of the respective local clocks means that thedeviation between them increases with time. By instead looking at theactual time that a message takes up and letting the schedule vary inrelation to the common, ideal system time, the messages can be packedcloser together in the scheduling. The time that the respective messagestake up on the bus varies very little between the different modules.This new way of thinking also means that the actual schedule willoscillate depending upon how long “pre-ignition” is set, the length ofthe messages, the deviation of the local clocks from the virtual idealtime and the presence of empty time slots. Maximum tolerance is achievedif the nominal time for transmission is set to half the previous timeslot according to the virtual schedule and if the maximum deviationbetween the virtual clock and the clocks of the transmitting andreceiving modules is less than half the time slot for the message. Areceiving module then interprets a message that is started within theprevious time slot according to the virtual schedule and is ended withinthe current time slot as belonging to the current time slot. In thisway, by means of setting the tolerance for the actual schedule insteadof the tolerance for the appearance of the message within the schedule,a more efficient utilization of the available bandwidth is achieved,while retaining the advantage of time-scheduled systems that theidentity of the message can be determined by where it appears in theschedule. If the CAN protocol is used, the “pre-ignition” must bereduced by at least one bit time in order to ensure that the arbitrationfunction does not come into effect in the event of a collision.

By providing each message with a unique identity, a redundancy in thecommunication is obtained that can be utilized in various ways. If thecommunication is designed in such a way that messages are normally to befound in given time slots, then it is easily detected if such is not thecase. This is described in the article “CAN for Critical EmbeddedAutomotive Networks” in IEEE Micro July-August 2002. Another way ofutilizing this solution is to deliberately let messages try to betransmitted in time slots on each side of the allocated time slot. Thiscan be carried out by allowing there to be a greater deviation from thevirtual clock than a half time slot. Messages will then change places,but as they have an identity, this does not matter. It is true that thereceiver has to be prepared to receive several messages and sort out thecorrect one, but the number of possibilities is limited in advance andthe requisite bandwidth is ensured in advance.

Many protocols, including CAN, utilize so-called “bit stuffing” in orderto synchronize the bit flow. In the case of CAN, the number of stuffingbits can vary from zero up to 24% of the number of bits in the originalmessage. In a traditional time-controlled system, a time slot would berequired that was 24% longer than the nominal length of the message.With the solution proposed in the invention, where the time slots areallowed to vary in length, the margin can be reduced to 12%.Alternatively, the time slots can be determined by the nominal messagelength and empty recovery slots can be inserted into the schedule inorder to compensate for the stuffing bits.

There is a prevalent belief among experts in the field concerningtime-scheduled systems that retransmission of discarded messages cannottake place. In the original CAN protocol, it is laid down that adiscarded message is to be retransmitted automatically. In laterversions of the standard, it is stated that this function need not beimplemented and the reason for this is that there is a desire also touse CAN in time-controlled systems. The traditional solution to theproblem is to increase the updating frequency by two or three times inorder to compensate for lost messages. This leads to a very poorutilization of the bandwidth. In connection with CAN, it has beenproposed that a time slot that is twice or three times as long should beallocated to the message and that one or two retransmissions should bepermitted. The second and third time slot are allocated to messages withlower priority. This provides a considerably better utilization of thebandwidth, but has the disadvantage that one or two messages can belost. By letting the actual time schedule vary, by utilizingnon-discarding collision detection with immediate transmission after thecessation of the collision and error signalling and by utilizing aunique identity for each message as described above, now also utilizingthe CAN characteristic that each identity is associated with a uniquepriority and that a discarded message is immediately retransmitteddepending on its priority, it is possible elegantly and efficiently tosolve the problem of achieving more efficient utilization of thebandwidth. By allowing the automatic retransmission and co-ordinatingthe allocated time slot with the message's priority, the characteristicsof the communication can be tailored according to the requirements ofthe total system. If the previous message has a higher priority than thenext one, the previous message will go out onto the bus immediately inthe event of retransmission. Lost messages will conflict with subsequentmessages in the same way. If all the following messages have lowerpriority, a retransmission will result in the following messages beingdisplaced by one time slot. If the following message has higher prioritythan the discarded message, then the discarded message will not go outuntil there is a message with lower priority or until the bus becomesfree. In normal circumstances, discarded messages seldom occur. It isconsidered in general that if there is more than one discarded messagein 1000, then that is an indication of a system problem. With theproposed invention, it is therefore possible in practice to obtainpractically 100% bus utilization with a short and easily predictablewaiting time for each message.

By designing the system so that it allows messages to change position inthe virtual schedule within given limits, it can be permitted that alarmmessages are transmitted not according to schedule, even if practicallyall the available bandwidth is utilized for the normal communication.

In traditional time-controlled systems, great importance is placed uponthere being a physical reference clock (master clock) in the system andupon all clocks being set in relation to this. See, for example, thestandard ISO 11898-4, referred to above. With the proposed invention,this problem can be simplified considerably. The virtual clock does notexist physically, but the local physical clock in the respective nodecan be set in relation to the virtual clock in many ways. In itssimplest form, this is carried out simply by utilizing the ever-presentinternal clock in the CAN Controller which is used for bit codingaccording to the Non-Return-to-Zero concept. If, for example, it isdetermined that the virtual clock is zero when message A1 in module A istransmitted, then this can be used as reference for module B byinstructing this to transmit its message B1 when the message A1 has beenreceived. B1 can be used as a reference for the virtual clock for moduleC, and so on. In this way, modules without special clock-function can beintegrated into the system. In this way, a module D with a primitiveclock can also be integrated into the system by instructing it totransmit message D1 50 ms after it has received A1 and to transmit D2 10ms after B2, etc. It can be seen that, in this way, module schedules canbe created simply in modules that are not designed for time-controlledsystems and that considerable redundancy can be incorporated. The moduleA can be related to an actual clock with high accuracy, for example GPS,and in this way the whole system can be kept within small tolerances. Itcan also be seen that systems can be constructed with a hierarchy ofvirtual clocks and that complex systems can be constructed which are inprinciple time-controlled, but in which many, and in the extreme caseall, of the modules in the system in reality do not have physical moduleclocks. The virtual clocks are tools to help the system designer todevelop communication according to principles for time-controlledsystems and thereby make his system fulfill stringent real-timerequirements. The actual schedule is constructed by programming therespective modules to transmit their messages in suitable relation tothe virtual schedule. As is shown by the examples, there are many waysof achieving this by utilizing the characteristics of CAN which wereoriginally developed to solve other problems.

A detailed description of the invention in accordance with what followsshows how the bus connection is utilized more efficiently and how lowerrequirements are imposed on the clock function in the respective module,or alternatively how it is completely replaced by utilizing one or moreprevious messages as triggers for transmission attempts.

BRIEF DESCRIPTION OF THE DRAWINGS

A currently proposed embodiment of an arrangement that has thesignificant characteristics of the invention will be described below,with reference to the attached drawings in which:

FIG. 1 shows schematically a CAN system with the nodes A and B andadditional nodes C, D and Z and a traditional scheduling of somemessages from A and B,

FIG. 2 shows time slots in a virtual schedule with associated virtualclock and how the modules insert their messages in accordance with theiractual clocks,

FIG. 3 shows a traditional system operating with TTP and a correspondingsystem operating with the invention,

FIG. 4 shows a virtual schedule, applicable for all the followingexamples, an actual schedule in a respective module and resulting actualschedule on the bus for all modules for scheduling according totraditional principles. In addition, it shows resulting actual schedulesfrom the use of the invention without pre-ignition and a comparison ofthe two methods,

FIG. 5 shows corresponding actual schedules with pre-ignition and adiscard bus with retransmission of messages in comparison with anon-discard bus according to the traditional solution,

FIG. 6 shows corresponding actual schedules for a high-discard bus withretransmission of messages in comparison with a non-discard busaccording to the traditional solution,

FIG. 7 shows corresponding actual schedules where a message is set inrelation to the virtual clock and where other messages are indirectlyset in relation to the virtual clock by the respective messages beingthe trigger for one or more other messages, and

FIG. 8 shows the construction of the system in the form of a schedule.

DETAILED DESCRIPTION

FIG. 1 shows schematically a network with the modules A and B connectedto a few-core serial connection 1. The network can contain additionalconnected modules which have been indicated by C, D and Z. Each modulecan transmit and receive messages. The transmission of messages istime-scheduled. This scheduling is symbolized by 2, where 3 shows howmessages appear on the few-core connection, consecutively in time. Thetime is divided into time slots and the starting points for therespective slots are indicated by 4, 5, 6, 7 and 8. According totraditional scheduling, each module is now allocated smaller slots.Module A receives 5A to 6A for the message A1 and 7A to 8A for themessage A2. In the same way, module B receives 4B to 5B for B1 and 6B to7B for B2. Now the clocks in A and B are not synchronized, for whichreason the messages A1, B1, A2 and B2 in reality come within the nominalslots 4-5-6-7-8 but not according to the allocated slot. In the figure,the clock in A runs slower than the clock in B, for which reason the gapbetween A1 and B1 becomes greater than the gap between A1 and B2. Duringthe scheduling, buffer zones 5B-5A, 6A-6B, etc, must be inserted betweenthe messages in order that these will not collide as a result of therelative deviations between the module clocks. In the example describedabove according to traditional thinking, the actual correct time istaken as the starting point and buffer zones are scheduled in order tocompensate for local deviations from the correct time.

FIG. 2 now shows the new thinking. The scheduling is carried out againsta virtual clock. In the virtual schedule 22, the messages A1, B1, C1,A2, B2, C2, etc, are now inserted at the required times. In FIG. 2, themessages have been tightly packed for the sake of clarity. The times oftransmission of the respective messages are transmitted to therespective modules. Locally each module thus receives an actual schedulefor its messages: A receives an actual schedule for messages A1 and A2,B for B1 and B2 and C for C1 and C2. Each module has an actual clockwhich is set is relation to the virtual clock, 21A, 21B, and 21Crespectively, to which their schedules are related. Now the clock 21Ahappens to coincide with the virtual clock and the message A1 is sentout at the correct time. The clock in B runs fast and attempts totransmit before the transmission of A1 is completed. The collisiondetection in CAN means that B1 is retained automatically until A1 isfinished and is then sent out immediately. In spite of the fact that theclock 21B is wrong, the message will be sent out correctly according tothe virtual schedule. In the same way, the messages A2 and B2 will besent out correctly. The clock 21C is slow, so that a gap is createdbetween B2 and C1. This would have been able to be prevented if theactual local schedules had been put forward in relation to the virtualschedule, that is if there was deliberate scheduling for collision. Intraditional thinking, the schedule is stationary in time while themessages oscillate (jump forward and back) in time. With the newthinking, the whole of the actual schedule will oscillate in time.

FIG. 3 shows schematically a system 31 with the protocol TTP/C and anidentical schematically drawn-up system 32 according to the inventionwith the protocol CAN. The TTP system has the modules 31′, 31″ and 31′″which are connected to the bus. Each module has a usual application withrequisite hardware, symbolized by HA, and the communication betweenthese is carried out via the communication units 33′, 33″ and 33 ^(m).These communication units are specially developed for TTP and contain aprotocol processor with associated ROM data, symbolized by PP and twoBus Guardians designated BG (only one is illustrated). Each PP and PGhas a clock, symbolized by C. The description of TTP is greatlysimplified, but the key feature for the comparison between TTP and asystem according to the invention is the existence and placing ofclocks. TTP is based on the correct time being maintained. Therefore PPand BG each have their own clocks. PP handles the transmission andreception of messages according to a time schedule. BG has a smallerpart of this schedule, namely at which times the module is entitled totransmit. Only at these times can PP physically send signals on the bus.At other times BG prevents this. The time schedule is constructed by asystem designer outside the system and this is downloaded to the systemusing a tool, symbolized by the unit V. TTP requires the specialcommunication units which provide a common time in the system and checkthat messages are transmitted at the correct times and that messagecollision is avoided. In contrast to this is shown the system 32according to the invention. Each module has also an application withhardware, H′, H″ and H^(m). The communication is carried out accordingto the CAN protocol and standard circuits for this are used in themodules 32″ and 32 ^(m). The module 32′ is assumed to have a CANcontroller specially developed for the system according to theinvention, with an integrated clock. The module 32″ has a clock that ishandled by the application, while 32′″ does not have a clock at all. Asfor TTP, a system designer constructs scheduling for the system, butthis is broken down and modified for each module, which receives a localschedule. These local schedules can be completely different in essence,but taken as a whole they form a well co-ordinated schedule for thesystem. The local schedules are downloaded to the respective modulesfrom a common unit symbolized by VV. This can be temporarily orpermanently connected to the system, or alternatively can beincorporated as a module in the system which has other tasks in additionto the scheduling of messages.

FIG. 4 shows schematically a virtual schedule represented by 41. This iscreated with a virtual clock 42 which generates a continuous timingwhereby the time slots T1, T2, T3, T4, T5, etc, are defined. Therequired transmission of the messages A1, B1, C1, A2 and B2 which are tobe sent from the respective modules A, B and C in the system have beeninserted in these time slots. The messages do not occupy the whole ofthe time slots as the virtual time is interpreted by an actual clock inthe respective modules. These all deviate from the virtual time. Eachmodule will have an actual schedule for transmission of its messages,which is illustrated by 43, and these schedules will deviate from eachother as a result of the clocks' deviations from the virtual clock. 43shows that the clock in the module A is fast by the amount dA but runsat the same speed as the virtual clock. The clock in the module B isslow by the amount dB and runs at the same speed as the virtual clock.The clock in the module C is correct at the start but runs slightly tooquickly, for which reason the deviation gradually increases which isindicated by dC and dC′. Each module transmits in accordance with itsactual schedule and the resulting actual schedule for the system as awhole which appears on the bus is shown by 44. Here it can be seen thatthere are slots of varying sizes between messages and thereby a poorutilization of the bandwidth. The messages B1 and C1 almost collide andwill do so at the next occasion unless their clocks are adjustedrelative to the virtual clock before then. If the module clocks keeppoor time, they must be synchronized frequently via synchronizationmessages, which steals bandwidth. This bandwidth loss can be reduced ifthe modules are provided with more accurate clocks, which makes themodule more expensive.

In order to avoid the requirement for accurate clocks, the CANcharacteristic is utilized to resolve collisions of messages withoutdiscarding and to deliberately put forward the transmission in themodule schedules. This is shown in 45. Here the respective messages havebeen scheduled to be transmitted almost 50% in the previous time slotaccording to the virtual schedule. The module A starts its transmissioneven earlier, as its clock is fast. The transmission of message Z iscarried out in this time slot and the message A1 will not go onto thebus until this is completed. In the example shown, this is carried outat the same time as A1 goes out onto the bus in the example 44. Themodule B attempts to send its message almost 50% in the time slot T1but, as its clock is slow, the message A1 has already been sent and asmall time slot arises between A1 and B1. In the same way, C sends outC1 and, on account of the relative effects of the clock deviations, C1goes out onto the bus immediately upon the attempt at transmission. A2goes out immediately thereafter, while there is a larger slot to B2.

In both examples, we have used the same virtual schedule as the startingpoint. With the traditional method, the highest possible bandwidth hasbeen utilized. With the new method, large margins have been created andthe messages are sent more quickly.

In FIG. 5, the same virtual schedule has been utilized as above and isillustrated by 41′. The example 51 shows that automatic retransmissioncan be utilized. It is assumed that the message A1 in the example 45 hasbeen discarded just before it was terminated and that it is sent again.The correct message goes out immediately after the corrupt message A1′.(This ignores components not directly affected by the invention in theCAN protocol's error handling such as error frames, etc, for which isonly required a time analysis during the scheduling, which is simple forexperts in the field and which does not affect the fundamentaldiscussion and the result in the main.) The module B starts itstransmission according to schedule with pre-ignition, but as A1 hasalready then started, B1 will go out onto the bus immediately after A1irrespective of their relative priorities. In the same way, C1 goes outimmediately after B1 and thereafter A2. A comparison with thetraditional, maximally utilized schedule shows that, in spite of theretransmission of A1, B2 goes out earlier by means of the invention.Both better utilization of the bandwidth and shorter maximum delay ofmessages have been achieved.

FIG. 6 shows the same case as in FIG. 4, but in which A1 isretransmitted twice and this results in a temporary 100% busutilization, but in spite of this B2 goes out slightly delayed. In thisexample, it has been assumed that B1 cannot be delayed, for which reasonit has been given a higher priority than A1. After two failures ofalmost complete A1 messages, B1 goes out with a small delay, after whichthe correct A1 goes out, followed by C1 and A2.

FIG. 7 shows how a time-scheduled communication can be set up withmodules without clocks. Here the module A is co-ordinated with thevirtual clock and with the modules B and C via the messages A1 and A2.In addition, it shows how redundancy is achieved by means of one messagetriggering several messages.

The example 71 shows in principle the same virtual scheduling as above.In this case, the fact has been taken into account that there is acertain delay after a message has been received correctly by a modulebefore this triggers a transmission of a message by the module inquestion. Here the message A1 is set in relation to the virtual clock.In the module B, the message B1 is set to be sent when A1 is receivedand in the module C, the message C1 is set to be sent when B1 isreceived. In the module A, A2 is set to be sent when C1 is received. Asis shown by the figure, the messages go out onto the bus bettersynchronized than with the use of the traditional method represented by44″. It can easily be seen that the method has a disadvantage in thatone omitted message can stop all further transmission. In order toovercome this problem, each message is allocated two or more messagesthat trigger transmission. This is shown in the example 72. Here A1 hasbeen set to trigger both B1 and C1, B1 to trigger C1 and A2, C1 totrigger A2 and B2, A2 to trigger B2 and C2, and B2 to trigger A3 and C3.Now A1 fails to trigger B1 but as it also triggers C1, this goes outinstead of B1. The whole schedule is thereby displaced one step to theleft. This does not matter, as each message has a unique identity.

The example above shows that, using the invention, not only do weachieve a better utilization of the bus's bandwidth and the use ofsimpler clocks, but also that the communication can be constructed to befault-tolerant with completely predictable maximum delays and that thesecan be optimized according to the system's real-time requirements bymeans of suitable choice of identifiers and priorities, maximum numberof permitted retransmissions, choice of accuracy of the clocks in therespective modules, choice of setting in relation to the virtual clockfor the respective module and message, etc, and that modules can begiven special rules for how the communication is to be carried out.Taken as a whole, these rules give a predictable appearance on the busfor each message. If any module should infringe any given rule, this iseasily discovered by one or more system-monitoring modules and thecommunication does not break down. System-monitoring nodes can alwaysissue correcting command messages, for example according to CanKingdom,by these messages being given higher priority than other messages.Traditional methods such as “bus guardians” used in traditionaltime-controlled systems can be used without problems, if considerednecessary.

In certain cases, it cannot be tolerated that messages are sent one ormore time slots earlier than scheduled. The case described above where adisplacement arises due to a node not sending its message, can beavoided by one or more modules being scheduled to send a dummy messagewith lower priority. If these find that they do not go out onto the busduring the first half of the time slot as a result of this beingoccupied, the transmission attempt is discontinued.

ISO 11898-4 is a standard for scheduling of messages in a CAN bus. Thestandard describes two levels for the clock function, Level 1 and Level2. Level 1 is characterized by the total time schedule being made up ofshorter partial schedules which are introduced by time synchronizationmessages being sent from a time master. In order to ensure that thesystem does not fail as a result of the time master failing, there is acomplex set of rules that enable one or more reserve time masters totake over in a secure way. In addition, there is a complex set of rulesin the standard for how the local clocks are to be synchronized with thetime master and how the respective module is to be able to determinewhether it is synchronized or not. All time measurement in Level 1 isrelated to the bit rate on the bus. Using the invention described, asystem can be constructed with much simpler means for obtaining anidentical appearance of messages on the bus, without the modules havingspecial clock functions that are synchronized with special time masters.This can be carried out by the virtual clock being set in relation toone or more messages via a selected event, for example indication of aposition of a motor's flywheel. When one or more modules indicate thisposition, this triggers the transmission of a special message. If thismessage is identical for all the modules that send it, it will beunderstood as being owned by all the modules that send it out within thefirst bit, Start Of Frame. If the deviation is larger than one bitlength, the message will be put in a queue in the losing module. A localtime-out terminates the transmission attempt after a time that isshorter than the length of message after the indication. An alternativeto this is to put the first message in the schedule after the startmessage at a higher priority than this. The start messages that are in aqueue will then lose out in the arbitration which makes it possible tolet the application in the respective module terminate the transmissionattempt after the receipt of the start message. Subsequent messages canthen be scheduled with the start message as a reference to a local clockwhich is started upon the receipt of the start message or by using somelater message in the schedule as a clock reference or by using one ormore previous messages in the schedule which directly trigger thetransmission attempt in the way described above.

By means of the invention, the problem with the scheduling is changedfrom following rules laid down that require all the modules to besynchronized with a given time master in the system or with a given setof rules applicable for all the modules for obtaining timing that iscommon to the system for a planned virtual scheduling which is convertedin practice by local rules in each module which are co-ordinated in adesign process which is unique for the system. By this means, thecharacteristics of the system can be optimized both with regard to costand features, by means of, among other things, eliminating the earlierbasic rule that messages must not collide on the bus in time-scheduledsystems. In addition, modules without clocks can be integrated intosystems based on time-scheduled communication.

Many time-controlled communication systems rely on a selected edge inthe bit flow on the bus for the synchronization of the local clockswithin the system. CAN utilizes falling edges for hard and softsynchronization of the clocks that are used for the synchronization ofthe time for interpreting the individual bits in the bit flow on thebus. The first edge, SOF, is often proposed to be used for clocks forother purposes, for example for scheduling of messages. However, inorder to distinguish this falling edge from a falling edge caused by aninterference, SOF is not indicated until at the sampling point. ISO11898-4 (TTCAN) utilizes this delayed indication of SOF in order todistinguish easily false edges from real ones. A disadvantage of thismethod is that the distance between the edge and the sampling point canbe different in different modules within the system, which leads to aninexact synchronization of the clocks. This can, however, be correctedeasily at local level if, for the clocks' synchronization, reference ismade to the edge and not to the sampling point, as this local deviationis known in the respective nodes.

For the invention, it is, on the other hand, an advantage to utilize thesampling point as a reference. In this way, it is possible easily tointegrate modules that are developed for event-driven CAN systems intime-controlled systems. When the message two time slots before iscorrectly received, the transmission trigger is set to be activated atthe next SOF. When SOF in the message in the preceding time slot isdetected, then the CAN controller is activated for transmission. As themessage has then already passed the arbitration stage, it will be sentimmediately after the preceding message has been terminated,irrespective of the message's priority. In this way, a module without aclock can be set in relation to a virtual clock and a virtual schedulewith a high degree of precision.

It can easily be seen that if the method above is combined with asuitable choice of priorities, then several messages can have one andthe same trigger message and also each message can have several triggermessages and in normal circumstances the messages will go out at thecorrect time. If any message is not sent, for example due to a modulefault, then all the other messages will still go out, displaced,however, by one time slot.

An alternative to using the sampling point as a reference is to use thefalling edge in the RTR bit after the CAN identifier. This is indicatedby all the CAN Controllers for soft synchronization and is thereby justas precise as SOF but has the advantage of being reliably identified.

FIG. 8 shows schematically how the construction of a system according tothe invention can be carried out. A system designer 80 designs a controlsystem 81 to be used in a product, for example a boat 82. In theexample, the system consists of a boat control unit 83 whichcommunicates, via a bus 84, with three motors with associated auxiliarydevices for course setting, raising and lowering of rigging, logs, etc,85, 85′ and 85″. The control electronics for the boat control unit 83are represented by 86 and for the respective motors by 87, 87′ and 87″.The system designer builds up the system in a computer-based tool 88which can be of a type according to U.S. Pat. No. 7,188,162, issued Mar.6, 2007, and U.S. Patent Application Publication No. 2005/0086382 A1,published Apr. 21, 2005. In addition to a selection of characteristicsthat are described in the documents referred to, the tool has also apart 89 for scheduling according to the invention. In a first step, thesystem designer develops one or more virtual schedules 90 based on oneor more virtual clocks 91 for the system as described above. The toolprocesses the virtual schedule into one or more local actual schedulesfor the respective modules which are indicated by 92, 93, 94 and 95.What is important for the invention is that the schedule is associatedwith the correct choice of identifier and their associations with eachother and their priority in the event of collision on the bus, for whichreason this has been marked specially by 92′, 93′, 94′ and 95′. The toolsupplies additional information i1 for settings, program codes, etc, forthe respective module which is indicated by 96. The information i2 thuscreated and processed is transferred to a configuring tool 97 via theconnection 98 which can be selected in a suitable way, for example via adiskette, file transfer in a digital network, etc. In addition toconfiguring the system, the information can be used for later analysisof the same and the configuring tool can advantageously be combined withan analysis tool which, among other things, can compare the virtualschedule with the actual schedule which appears on the bus during thesystem's operation. The configuring tool is connected to the system'sbus via the connection 99 and the connector 99′ and requisiteinformation 100 for local schedules, settings, etc, is exchanged betweenthe modules and the tool. The virtual schedule function can also conveydirect information i3 to the configuration tool 97 for requisiteprocessing.

101 shows schematically the functions comprised in the respectivemodule. The module is connected to the bus via a connector 101 which canbe a contact or a wireless connection, for transferring the bus signalsi4 to and from the module. The signals pass through signal-adaptingmeans 102, for example a CAN transceiver, which in turn is connected toa protocol circuit 103, for example a CAN Controller. This is connectedto a CPU 104 with requisite peripherals and application software 105 forthe module function. In addition, the module has at least software 107which can set received messages 108 on the bus in relation to messages109 which are to be sent. The module has an actual clock 110 which isset in relation to at least one edge on message signals on the bus, forexample the falling edge 111 at Start of Frame in a CAN message. In itssimplest form, the clock 110 consists of the clock incorporated in a CANController for bit synchronization and interpretation. The module can bearranged to handle time-controlled means symbolized by the unit 112 andthe outgoing and incoming signal connections 113. The controls i5 can berelated to the clock 110 and/or a clock 114 with a second time base, forexample a time base that varies with the engine speed. The module canalso be arranged to handle event-driven or event-controlling meanssymbolized by the unit 115 and the outgoing and incoming signalconnections 116. Signals i6 from events or triggering of events areco-ordinated with the time-related signals i5 and with the actualschedule (the actual schedules) in the module and with the messages'identities according to the arrangement 117 and 118. Activities in themodule trigger transmission of a message 119 on the bus according to theactual schedule which collides with the message 108. If the collisiontakes place in Start of Frame then, if it has a higher priority than108, the module's message will appear on the bus instead of the message108. The sender of message 108 will receive 119 and then again commencetransmission of 108. If 108 has the highest priority, the module willwait until 108 has been received and then send 119. If SoF has alreadybeen received, then the module waits to send 119 until 108 has beenreceived. The transfer or exchange of information or signals between thevirtual schedule and the system tool is symbolized by i7.

The invention is not limited to the embodiments described above, but canbe modified within the framework of the following patent claims andconcept of the invention.

1. A system, comprising: a plurality of modules connected to acommunication bus, at least one of the plurality of modules comprising ascheduler configured to receive a virtual schedule that provides atleast one slot for sending at least one message over the communicationbus; wherein the at least one of the plurality of modules is configuredto: confirm a trigger condition, and send the at least one message overthe communication bus in response to a confirmation of the triggercondition.
 2. The system of claim 1, wherein the scheduler is coupled toat least one virtual clock and further configured to determine a virtualtime for sending at least one prior message according to the virtualschedule.
 3. The system of claim 2, wherein the at least one of theplurality of modules is further configured to send the at least oneprior message according to the virtual time.
 4. The system of claim 1,wherein the confirming the trigger condition comprises receiving atleast one prior message over the communication bus.
 5. The system ofclaim 4, wherein the at least one of the plurality of modules is furtherconfigured to send at least one other message over the communication busin response to the confirmation of the trigger condition.
 6. The systemof claim 5, wherein the at least one message and the at least one othermessage are sent to different modules of the plurality of modules. 7.The system of claim 1, wherein the communication bus is configured tooperate according to a controller area network (CAN) protocol.
 8. Anapparatus, comprising: a scheduler configured to receive a virtualschedule and to confirm a trigger condition for sending at least onemessage in relation to the virtual schedule, wherein the virtualschedule includes at least one slot for sending the at least one messageover a communication bus; and a transmitter configured to send the atleast one message in response to a confirmation of the trigger conditionand to transmit the at least one message associated with the at leastone slot.
 9. The apparatus of claim 8, wherein the scheduler is furtherconfigured to determine a virtual time for sending at least one priormessage in relation to the virtual schedule.
 10. The apparatus of claim9, wherein the transmitter is further configured to send the at leastone prior message according to the virtual time.
 11. The apparatus ofclaim 8, wherein the trigger condition includes at least one priormessage being received over the communication bus.
 12. The apparatus ofclaim 11, wherein the transmitter is further configured to send at leastone further message over the communication bus in response to theconfirmation of the trigger condition.
 13. The apparatus of claim 12,wherein the at least one message and the at least one other message aresent to different modules of a plurality of modules.
 14. The apparatusof claim 8, wherein the communication bus is configured to operateaccording to a controller area network (CAN) protocol.
 15. A method,comprising: confirming a trigger condition for sending at least onemessage based on a virtual schedule, wherein the virtual schedulecomprises at least one slot for sending the at least first message overa communication bus; and transmitting the at least one message from amodule over the communication bus in response to a confirmation of thetrigger condition, wherein the transmitting begins inside the at leastone slot for sending the at least one message.
 16. The method of claim15, wherein the trigger condition includes at least one prior messagebeing received over the communication bus.
 17. The method of claim 16,further comprising sending at least one other message over thecommunication bus in response to the confirmation of the triggercondition.
 18. The method of claim 17, wherein the at least one messageand the at least one other message are sent to different modules of theplurality of modules.
 19. The method of claim 15, further comprising:determining a virtual time according to at least one virtual clock forsending at least one prior message based on the virtual schedule. 20.The method of claim 19, further comprising: transmitting the at leastone prior message over the communication bus according to the virtualtime.